Tag: Hack

Assuming you’ve got a soft-modded Wii, most games will work fine with USBLoaderGX, however some newer games just won’t work with your standard Waninkoko cIOS 249 using cIOS 38 rev 14 (GH5, RB2, Band Hero, Mercury Meltdown Revolution etc.). To fix this you need to install Hermes’ cIOS 222 in 38 merged with 37 mode, and then tell USBLoaderGX to use IOS 222 to launch the game.

Now, when you want to run something like Rock Band 2, just use USBLoaderGX as normal, but when you select the game, select Game Load from the game settings and choose to use IOS 222 instead of the default IOS 249. Save the setting and the game will always use IOS 222, and always work.

That’s it – job done :)

On top of installing CIOS 222, I’ve read that some folk will run CIOS 222 installer again, this time using IOS 249 to install IOS 223 with the option IOS 60 merged with 38 – which gives you the option of using IOS 223 to try to get games working which might be particularly stubborn, but I didn’t bother doing this additional step as I don’t have anything that won’t run anymore! Worth bearing in mind in case sometime down the road some software does get narky about using 249 or 222 though…

So you’ve got your Wii soft-modded and you can run homebrew and stuff (you haven’t? Well, ya could..) – what next? Well, you can install a whole heap of WiiWare, Virtual Console games and applications, but the Wii can only store a couple of hundred MB of stuff on its internal memory before it’s full. When this happens it’s like your drive’s full – you’re going to have to uninstall some things to install others.

Or… you could use NAND emulation to install as much stuff as you want! Sound more like it? Let’s get it on!

Intial prep

The Wii has 512MB of flash (i.e. NAND) memory, much like a USB stick – and it uses it to store the Wii operating system, save games, channels/WiiWare/VC stuff etc. When you soft-mod your Wii you’ve (hopefully!) backed up the system memory so you can restore it to default, in case you want to. If you’ve backed up your NAND system memory using BootMii, this is all well and good, but it’s not what we’re going to be using as the basis for our NAND emulation (i.e. the backed up nand.bin file) – we’re going to strip out just what we need to get a bare-bones NAND image (really, just a set of directories) and then use that to install our stuff.

To begin with, we’ve got two options:

We can use a SD card to store our installed apps/games/channels (or SDHC card if your firmware is > 4.0, previous version of firmware don’t support SDHC cards), or

In this guide I’m going to set things up on a SD card, if you want to use a hard drive you’ll need it partitioned to have TWO partitions (each of which needs to be assigned a drive letter – not sure how? Try this): One large partition for your Wii ISOs which you’ll want to format using something like WBFS Manager, and the other smaller partition you can leave as standard FAT32, just like you’d have on your SD card or a USB stick.

On an SD card we can just use whatever space is available on the card, for hard drives you’re going to have to decide on how big the partition you want to use for NAND emulation is going to be (a couple of GB should do it plenty), assign the rest to the other partition for your WBFS ISOs. I’ve got a 640GB USB drive, so I’d prolly assign around 20 to 25GB for emulation so I’d have stacks of space for ROMs etc. – remember – there are no tools to resize WBFS partitions at the moment – so pick your sizes and get it right first time! =D

Okay, with that out of the way – let’s kick off with the emulation steps:

Once you’ve run Simple FileSystem Dumper 0.2 you’re going to have a bunch of extra folders on the root of your SD card (or hard-drive, depending) – the new directories are these:

Make a copy of all these “blank” folders! Later on you can delete the folders off your SD card or HD and copy these “blank” folders back to effectively uninstall any installed WADs. You can prolly use WAD Manager etc. to just uninstall specific WADs, but I haven’t tried it out as yet. The folders are useful and only around 180MB in total, so it’s worth holding on to pristine copies.

Step 2 – [If neccessary] Update CIOS 38 to Revision 14

To use NAND emulation you absolutely need CIOS Revision 14 or higher. My Wii was on Revision 13b or something, so I used Waninkoko’s CIOS Updater and a net connection to get it up to Revision 14. You can find a copy like this…

Step 3 – Preparing the WADs for your emulated NAND

From what I’ve read you can install your WiiWare/Virtual Console WAD files to the emulated NAND using any of the following methods:

By using WAD Manager 1.5 or higher.

By using NeoGamma R6 or higher.

Manually.

Because I formatted my USB Hard drive as a single partition in WBFS format (and I can’t be bothered to fix it up to have two partitions quite yet), and because you must have different source and destination locations at present to install WADs using NAND emulation (that is, SD to HD or HD to SD, not SD to SD or HD to HD) – I’m going to show you how to go with the manual method of installing stuff to your emulated NAND. And for this we’re going to need a little win32 application called wad2NAND.

Create a batch file called ConvertWADs.bat in the folder you extracted wad2nand to. Put the following in the batch file:

@echo off
for%%xin(.\Convert\*.wad)do start /w wad2nand.exe "%%x"

Then:

Create a folder called Convert inside the folder where you extracted the wad2nand zip

Copy a bunch of WAD files (As many as you like! Woo-hoo! Or as many as you have space on your emulated NAND location for, really!) into that Convert folder and run your ConvertWADs.bat batch file

Give it a minute to extract all the wads to two folders: ticket and title which will appear in the folder where you extracted wad2nand – remember these folders from earlier?

Update: Although the title and ticket folders hold the core content for games or apps or whatnot, I’ve read that the additional folders hold things like Miis and high-scores and things, so none of the folders are cruft or anything, and if you’re finicky about such things you’re best to hold on to them.

After running wad2nand, the ticket and title folders will contain the installed version of the files to play whatever WADs you’ve converted. You now need to copy these two folders over the top of the “blank” nand folders on the root of your SD card or hard drive. Select [Yes to all] to overwrite things if there are duplicate files – just merge ’em all together. Almost there!

Step 5 – Launch the NAND emulation installed WADs

To do this, I’m going to use an application called Triiforce beta 7. Grab it and launch from the Homebrew Channel, then select your source (SD / HD / Wherever you’ve installed the extracted WADs).

Updated Note: TriiForce beta 7 is now available, at the time of writing TriiForce beta 5 was the latest version available, so that’s what you’ll see in the below screenshots.

By selecting the second from top option in TriiForce (showing a WAD version of Backup Launcher in the screenshot above) you can press left and right on the D-Pad of the Wiimote to select which WAD to run, and then just select the Start option above to launch it!

Post last updated: 19th of August 2011, but before that it was February 2010. If the screenshots don’t exactly match up (i.e. says to install WAD Manager v1.5 mod3, screenshots have v1.4 etc) – don’t panic, I’ve just updated the article but not the screenshots. Also, I’ve added mention to using LetterBomb instead of BannerBomb, but I don’t have step by step directions for it – google is your friend.

You will need:
– A Wii (hopefully with firmware 3.XE or 3.XU, where X is 1, 2 or 3)
– A Wii-mote
– (if you’re hacking a new [2008 and onwards] Wii and want to back up the system memory) A Gamecube controller
– A SD card [NOT a SDHC card, as you need 4.0 firmware or higher to use those]. The SD card must be formatted in FAT format and at least 1GB in size.
– An internet connection your Wii can use
– An hour or two to get it all sorted

You will NOT need:
– A copy of Zelda: Twilight Princess

Optionally can be used to control BootMii option selection & fix a bricked Wii:
– A Gamecube controller

Please Note: I’ve put together ALL the files I used to hack the Wii as a single zip which you can find here – please read the included readme.txt for usage instructions. Also, as this post ages there might be newer version of files, so you might want to get each bit yourself to have the latest versions. The Wii hacking files have been updated on 10th January 2010 to include latest revisions of cIOS installers + apps (WadManager v1.5 mod 3, Hermes CIOS 222 v4, Trucha Bug Restorer v1.1, USB Loader GX r815, BootMii 0.60 beta, Preloader 0.30 etc).

Also, instead of just following this guide step by step as you go along, I’d -STRONGLY- recommend reading through the entire thing so you’re pre-warned about bits and pieces and -THEN- going through it step by step, looking ahead occasionally so you’ve got the right files on your SD card for the step, and maybe the step ahead.

FINAL WARNING(S): In the highly unlikely event that you brick your Wii – it’s not my fault. Also, never remove a SD card from a powered on Wii – it can (and will) corrupt the partition on the card and you’ll need to reformat it (not quick-format). If your SD card suddenly becomes read-only and you haven’t accidentally slid the lock/unlock slider to lock – this is exactly what you’ve done.

Step 1 – Get a suitable exploit

Update: If you have a recent Wii with stock firmware of 4.3 or later then you need to use the LetterBomb exploiter, and not BannerBomb. Substitute as appropriate for the rest of the article.

Step 2 – Get a boot agent

Go to http://bootmii.org/download/ and download HackMii Beta 2. Extract it, rename the “Installer.elf” file to “boot.elf” and place it in the root of your SD card.

Step 3 – Prime your Wii

Make sure your Wii is able to connect to the Internet, turn the Wii off, insert the SD card, then boot up the Wii.

Step 4 – Prep the exploit

Go to the Wii button (bottom left at the system menu), then Data Management | Channels | SD Card. A box will pop up saying Load boot.dol/boot.elf – click [Yes]

Step 5 – Run the exploit

Update: If you’re using LetterBomb instead of BannerBomb, use your own common sense with the following instructions.

Press the 1 button to install the BannerBomb exploit. If your Wii freezes with a black and white memory dump, or just plain freezes for a couple of minutes at this point you need to go get the next recommended version of the BannerBomb exploit in the list provided in step 1, replace the private folder on your SD card with the one extracted from the different BannerBomb exploit zip (aad20_v108.zip), and try again from Step 4. If this doesn’t work either, pick the next BannerBomb exploit zip and wash/rinse/repeat.

Step 6 – Install useful software

Once HackMii is running, it will offer you the opportunity to install The Homebrew Channel, DVDX and BootMii – install them all! Note: When you install BootMii, I’d recommend installing it as boot2 instead of an IOS file – it just means that it’ll be available should you somehow manage (however unlikely) to mess up your Wii, and you’ll be able to recover things to a clean state.

Updated Note: Newer Wiis (2008 and newer) come configured so that you cannot install HackMii as boot2 – you have to install as IOS. Don’t worry though, we can still back up your system memory, and later, get preloader installed for recovery (should we ever need it) after we’ve restored the Trucha Bug. From the BootMii.org site:

What does “The installed boot1 version prevents a boot2 install mean? Are you going to fix it?
No, it can’t be fixed. Installing as boot2 is the most useful way to install BootMii, but it requires that we exploit a particularly silly bug in a part of the system that can not be changed under any circumstances. Nintendo finally fixed this bug in new Wiis that were released sometime in 2008. We have looked for a suitable replacement for this exploit, but have not found one, and it does not seem likely that anyone ever will.

Step 7 – Backup your original (stock) system

Now you have BootMii installed, restart your Wii and you’ll be greeted with the BootMii screen with 4 icons – at this point you can either use a Gamecube controller to navigate, or use the Power button to move to the next selection, then the Reset buttom to select an option. Navigate until the the far right Settings icon is selected, then push the A button on Gamecube controller (or the Reset button on the Wii) and you’ll see options depicting writing from a chip (on left) and writing to a chip (2nd from left) – pick the left one to back up the system memory of your Wii so you’ve got it available in case something wonky happens w/ your Wii. It’ll take about 10-15 mins to back up the system memory to a file called nand.bin on your SD card. Once this is done, go back to the top BootMii menu and load the System Menu as normal – you’ll see the Homebrew channel there with lovely bubbles for you to pop. Hurray! =D

Updated Note: When hacking a new Wii where BootMii had to be installed as an IOS instead of boot2, I wasn’t able to use the buttons on the Wii to navigate the BootMii menu to backup the system memory, instead I had to use a Gamecube controller, which worked fine. You should be able to use the Power button to change selections, then the Reset button to actually select your option, on one Wii I hacked this didn’t seem to work so I just used a Gamecube controller, but it could have been I’d just forgotten you need to hit the Power button to change selections, as it’s a pretty un-intuitive thing to do…

Step 7.5 – Re-introduce exploits

Newer Wiis come with the Trucha bug (i.e. fakesign) fixed – but we need it to softmod our Wii properly, so we’re going to have to re-introduce the bug by installing older IOS files using Trucha Bug Restorer. Grab yourself a copy, place it in a folder in your “apps” folder on your SD card with the .dol file renamed to boot.dol, watch this video on how to use it, and follow along until you’ve successfully restored the Trucha bug, so you can install custom firmware in step 8 below.

Updated Note: When I used Trucha Bug Restorer, after downgrading IOS 15 as shown in the video the Wii wouldn’t connect to the network to download the older version of IOS 36 to patch, so I ended up using NUS Downloader to get a copy of IOS36-64-v3351.wad which I placed on the root of my SD card and then pointed TBR at that instead of using the network connection, it then updated fine and I restored IOS 15 via network connection as per the video instructions.

Step 8 – Install custom IOS’

Get and run Waninkoko’s cIOS 38 Rev 17 Installer as an app (i.e. create a folder on SD card called “apps”, inside this create a folder like “cIOS38-Installer”), place the file in this folder and rename it to boot.dol. Run the installer through the Homebrew Channel and it’ll install and patch a bunch of IOS files, including IOS 249 which is needed to run loads of stuff.

Updated Note: If you get error = -2011 during the install process of this, you need to go back to step 7.5 above and make sure the version of IOS 36 installed is the hacked cIOS version with the Trucha bug.

Step 9 – Update the firmware

Now we’re going to update the firmware to a custom version of 4.0 that leaves the trucha (fakesign) exploit open for us (in my experience you HAVE to install 4.0 before 4.1 otherwise you’ll get a ret = -1036 error if you try to go directly to 4.1), so, grab Wanninkoko’s Firmware 4.0 Updater, rename the extracted file to boot.dol, create a folder for it in the apps folder on your SD card and run the app through the Homebrew Channel

You’ll know you’re on the 4.0 firmware not only because it’ll say so on the first page of the Wii Settings channel, but because you’ll have a SD icon in the System Menu as shown below…

Step 10 – Update the firmware

Step 11 – Add some useful channels

Okay – we now have the latest custom 4.1 firmware and the Homebrew Channel, but we need a couple of more bits and pieces to get us to the finish line. For this you need some knowledge: Wii virtual console games (that is, SNES games, Genesis games, etc.) come as .WAD files, which need to be installed to the Wii system memory or NAND emulated system memory to play. For this, we use a program called Wad Manager – so we’re going to install a custom version of Wad Manager that comes as a channel and has other nice goodies like directory support. To install this wad manager, we need a wad manager! So to get a copy of WAD Manager 1.5 mod3 as an application AND as a channel, head on over to here. Extract the rar file, and place the .dol on your SD card in the apps folder in its own folder (making sure the .dol file is renamed to boot.dol) and run it through the Homebrew Channel, -NOW- from the WAD manager we’re running as an app, install the WAD Manager 1.5 mod3 channel

Step 12 – Add a disc launcher

To run ISOs downloaded from t’internets, you need backup launcher. Install Backup Launcher 0.3 gamma with #002 fix from (link now broken & removed) – then, when that’s installed as a channel (through the WAD Manager channel we installed in Step 11 above) you’ll be able to insert the burnt ISO DVDs and launch ’em through the Backup Launcher channel.

Step 13 – Add a hard-drive launcher

[OPTIONAL] If you want to run games from a hard-drive, you’ll want to get a copy of USB Loader GX – find a version that installs as a channel (i.e. a wad not an app) and install this if you want. I’m not going to go into too much WBFS (Wii Backup File System) stuff here – the easiest way is to just get a compatible USB hard-drive, plug it into the leftmost of the two USB sockets on the back of the Wii (leftmost when you’re looking at the front of the Wii), let USB Loader GX Format it for you, then you’re good to go.

Updated Note: If you plan on using a USB hard drive with your Wii, which really is the way to go, make two primary partitions – one FAT32 partition for Wads/NAND Emulation (have a look at my article on it here if you’re interested) and one for your ripped Wii ISOs (format doesn’t matter – USB Loader GX will reformat it anyway). My setup, on a 320GB drive is 20GB for Wads/NAND, 280GB-ish for ISOs.

Step 14 – Final tweaks

Almost done! At the moment, it’s possible that each time the Wii boots, BootMii will come up and we have to press the Reset button on the Wii to go to the system menu – although to be fair I haven’t seen this behaviour on anything but the first Wii I modded. If this occurs you can just rename the “bootmii” folder on the root of your SD card to something like “GET-RID-OF-THESE-CAPS-TO-ENABLEbootmii“. Now, get a copy preloader 0.30 final (it’s an app, not a wad) – make a folder for it in the apps folder of your sd card, copy it in again making sure the .dol file is called boot.dol (starting to see a pattern?). Before you install the app, you might want to get a copy of the 4.1 version of hacks.ini from here and place it in the root of your SD card. Launch the preloader 0.30 app through the Homebrew Channel and install. In Preloader, navigate to System Hacks and feel free to change some options (disable background music, disable standby mode, region-free everything etc.).

You can choose to boot the Wii to preloader, or straight to the System Menu (which I prefer) – if you ever want to get Preloader back up to change any settings, recover the Wii or what-not, just turn the Wii off, then turn it back on and hold down the RESET button while it’s booting – voila! Preloader is there for you to launch things, go straight to the Homebrew Chan, change system hacks etc.

Updated Note: Preloader 0.30 is the newest version as of the 8th December 2009 – the screenshots below are from when I installed Preloader 0.29 – it’s gonna be pretty much the same thing if you’re installing newer. When you use the systemhacks in preloader, make sure that you you set the Block Disc Updates and Block Online Updates to enabled so you keep your custom firmware if you insert an original disc of a game with a newer firmware version than you’re currently running! However, if you want to play your original Beatles: Rock Band or some of the other, newer rhythm-music games you’ll need to do a little bit of extra patching, which I’ve written about here.

Step 15 – Make it easy to get apps

[OPTIONAL] Install the Homebrew Browser Channel, if you want…

Step 16 – EnJoY!

– You might want to edit bootmii.ini in the bootmii folder on your SD card, where you can change the autoboot setting to system menu, and change the delay in seconds (0 if you don’t want to see bootmii at all).

– Once you’ve got custom firmware on your Wii, DO NOT install stock Nintendo firmware. If you buy a new game which needs newer firmware, use the preloader “skip disc update check” option to avoid having to install any updates to play or rip the disc and run WiiScrubber on it to remove the firmware.

– If you decide to play imports FOR THE LOVE OF BOD do NOT install Japanese firmware on a non-Japanese Wii – it will brick your Wii. No, really. With any luck you could get BootMii going and restore your nand.bin to get the system back, but don’t tempt fate.

Anyways, Happy Wii-Modding!, and if you have any problems or questions, feel free to sling ’em in the comments below and I’ll have a gander.